Which path/filter/tier is right for me?
Pick the option that sounds most like your home or ministry. We’ll show you the correct setup links and instructions.
Scripture-rooted DNS filtering
GraceDNS keeps congregations and households focused on Christ by filtering the web through prayerfully maintained block lists. There is nothing to buy or install—just trustworthy DNS endpoints you can adopt in under a minute.
We never log the sites you request. Every lookup travels through encrypted, private channels so your devotion and study remain unseen.
The simple steps on this page help volunteers shield sanctuaries, classrooms, and offices without an IT staff.
Set one tier on the router and every phone, TV, and tablet follows the same Christ-centered guardrails.
Missionaries, college students, and travelers can protect a single device from anywhere in the world.
Our calling
GraceDNS serves pastors, parents, and disciplers who want every screen to echo Philippians 4:8. Our motto comes from Psalm 101:3—“I will set no worthless thing before my eyes.” We constantly review harmful domains so the Church can worship, study, and fellowship without digital noise.
Volunteer teams can secure sanctuaries, offices, and classrooms using the step-by-step instructions shared here.
Three tiers let parents match their convictions without needing special hardware or subscriptions.
Believers on mission, at school, or on the road can point one device to GraceDNS in moments.
Schools and co-ops can assign the right tier to each lab or room through clear, printable directions.
Paths for every household
Pick the tier that matches your convictions and copy either the DNS-over-HTTPS (DoH) address or the DNS-over-TLS (DoT) hostname. Once saved, every request routes through GraceDNS automatically.
Every tier is tuned to avoid needless breakage—the difference between Sinai, Zion, and Glory is how aggressive we get. Our developers even run Glory full time so we can spot and fix issues quickly.
Which path/filter/tier is right for me?
Pick the option that sounds most like your home or ministry. We’ll show you the correct setup links and instructions.
A peaceful starting tier that blocks obvious harm and fraud while letting daily browsing operate as expected.
Most private option—enter this whenever a device supports DNS-over-HTTPS.
Private fallback for gear that asks for a TLS hostname or Android Private DNS entry.
Primary IPv4
Secondary IPv4
Not encrypted—use only if DoH and DoT are unavailable on that device.
Works for iPhone, iPad, and Mac (including iMac and MacBook).
Builds on Eden with decisive blocks for explicit content, gambling, piracy hubs, and bypass tools. SafeSearch stays enforced on every major search engine.
Preferred Sinai endpoint; use it whenever a platform lets you paste a DoH URL.
Second choice—encrypted via TLS for clients that only accept hostnames.
Primary IPv4
Secondary IPv4
Unencrypted legacy service; rely on it only when secure DNS cannot be configured.
Works for iPhone, iPad, and Mac (including iMac and MacBook).
Extends Sinai by stripping broad ad networks, push-alert trackers, and cross-app telemetry so prayerful spaces stay calm.
Best privacy for Zion—browsers and apps should use this DoH URL whenever possible.
Use this TLS hostname when devices rely on Apple profiles or Android Private DNS instead of raw URLs.
Primary IPv4
Secondary IPv4
Legacy IPv4 stays unencrypted; reach for it only if secure DNS settings are missing.
Works for iPhone, iPad, and Mac (including iMac and MacBook).
Our most controlled tier, silencing nearly every tracker, referral system, and telemetry feed. Reserve it for kiosks, pulpits, or supervised ministry machines.
Strongest privacy—always start with this Glory DoH link.
Second-best, encrypted via TLS; point Apple/Android Private DNS profiles here when DoH cannot be set.
Primary IPv4
Secondary IPv4
Last resort because traffic is unencrypted—use only if the secure options truly cannot be configured.
Works for iPhone, iPad, and Mac (including iMac and MacBook).
Guides for every device
Every major platform already understands secure DNS. Copy the DoH URL or DoT hostname for your tier, follow the short guide below, and your devices immediately inherit GraceDNS protections.
sinai.gracedns.org) and tap Save.Older phones may need a trusted DNS app from the Play Store. Choose one that lets you paste the DNS-over-HTTPS URL.
Allowwhen Safari asks to download the profile.
iPhone and iPad trust these profiles system-wide, so every app follows the tier you select automatically.
Installand confirm with your password.
Prefer manual entry? Open System Settings → Network → Details → DNS and paste the same hostnames shown above.
Encrypted only (DoH)if available, then save.
Older builds without DoH support will still honor the IPv4 entries, just without encryption.
Keep another tier handy in case certain smart devices need less aggressive filtering.
Perfect for schools, co-ops, libraries, and multiuser carts.
We test Glory daily to keep it usable, but it is still the strictest tier—keep Sinai or Eden nearby for devices that must stay flexible.
Convictions we uphold
Anchored in Scripture
“I will set no worthless thing before my eyes; I hate the work of those who fall away.”
Psalm 101:3 steadies our block lists. If a site pulls hearts away from Christ or delights in sin, we remove it so the Body can stay focused on the Lord.
Psalm 101:3 (NET)
Shared stewardship
GraceDNS is a ministry effort. If the Lord prompts you to help cover servers and the time spent curating block lists, consider $5/year for an individual, $15/year for a household, or $3/student/year for schools. Give whatever fits, or nothing at all—we are grateful either way. GraceDNS remains free for individuals, families, nonprofits, and local churches. We simply ask that you use prayer and discernment as you consider whether GraceDNS fits your household or ministry and whether the Lord is leading you to share a gift. If you’re a for‑profit business or industry group, send us a note so we can pray with you and prepare a simple quote that fits your needs.
GraceDNS is not a 501(c)(3), so gifts are not tax-deductible and cannot be refunded. Stripe emails a receipt instantly.
Need a ministry invoice? Email us.Need guidance?
Eden blocks obvious harm and scams. Sinai adds explicit, gambling, and piracy protections with SafeSearch. Zion removes wide ad networks and tracking. Glory blocks nearly every telemetry feed and sometimes needs special allowances.
Every tier is tuned to avoid needless breakage, but the more we block, the higher the chance something relies on it. Zion may occasionally pause notification-heavy apps, and Glory might need an allowlist entry. Our team runs Glory all day so we can fix problems quickly; keep Sinai or Eden handy for anything urgent.
Most households start with Sinai for firm protection and minimal breakage. Use Eden for work devices that must remain flexible. Reserve Zion for quiet spaces and Glory for supervised stations.
We only capture the information needed to answer DNS requests. Short-lived troubleshooting logs may include anonymized network data (for example, IPv4 addresses masked to 123.123.123.xxx), and are deleted once we resolve technical issues. We never sell data or build marketing profiles, and every lookup travels over encrypted transport.
Replace the DoH/DoT endpoint in your settings or install a new profile. Most devices adopt the new tier within seconds.
No. We gladly serve churches, homes, missionaries, schools, and anyone who wants Christ-honoring filtering.
Covering details
Ole Brook Web Services in Mississippi builds practical tools for churches and small businesses. We built GraceDNS first and foremost to serve Christ; along the way it became the default DNS we use to protect every Ole Brook Web Services client network, and we are humbled to offer that same protection freely to the wider Body.
Visit olebrookwebservices.com